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Abstract. We introduce a new family of quantum secret sharing protocols with 
limited quantum resources which extends the protocols proposed by Markham 
and Sanders [13J and Broadbent, Chouha, and Tapp [17]. Parametrized by a 
graph G and a subset of its vertices A, the protocol consists in: (i) encoding the 
quantum secret into the corresponding graph state by acting on the qubits in A; 
(ii) use a classical encoding to ensure the existence of a threshold. These new 
protocols realize ((k, n)) quantum secret sharing i.e., any set of at least k players 
among n can reconstruct the quantum secret, whereas any set of less than k 
players has no information about the secret. In the particular case where the 
secret is encoded on all the qubits, we explore the values of k for which there 
exists a graph such that the corresponding protocol realizes a ((k,n)) secret 
sharing. We show that for any threshold k > n — n 0,68 there exists a graph 
allowing a ((A:, n)) protocol. On the other hand, we prove that for any k < j^n 
there is no graph G allowing a ((fe,n)) protocol. As a consequence there exists 
no such that the protocols introduced by Markham and Sanders in |13| admit 
no threshold k when the secret is encoded on all the qubits and n > no. 
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1 Introduction 

Secret sharing schemes were independently introduced by Shamir [TB] and Blak- 
ley [I] and extended to the quantum case by Hillery [9] and Gottesman [3|6| . 

A ((k,n)) quantum secret sharing [9|3|6j is a protocol by which a dealer 
distributes shares of a quantum secret to n players such that any subset of at 
least k players can reconstruct the secret by combining their shares, while any 
set of less than k players cannot have any information about the secret. It is 
assumed that the secret is an arbitrary one-qubit state, that the dealer has only 
one copy of the secret he wants to share and that the players can communicate 
together using classical and quantum channels. 

A direct consequence of the no-cloning theorem [19] is that no ((k,n)) quan- 
tum secret sharing protocol can exists when k < ^ - otherwise two distinct sets 



of players can reconstruct the secret implying a cloning of quantum secret. On 
the other hand, for any k > S a ((k,n)) protocol has been introduced in [6] in 
such a way that the dimension of each share is proportional to the number of 
players. 

The unbounded size of the share is a strong limitation of the protocol, as a 
consequence several schemes of quantum secret sharing using a bounded amount 
of resources for each player have been introduced |13I17|12] . In particular, in 
|13| a quantum secret sharing scheme using graph states is presented where each 
player receives a single qubit. At the forefront in terms of implementation, the 
graph states has emerged as a powerful and elegant family of entangled state 
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Only few threshold quantum secret sharing schemes have been proved in 
the literature to be achievable using graph states: ((3,5)) can be done using 
a C5 graph (cycle with 5 vertices), and for any n, an ((n, n)) protocol using 
the complete graph can be done, up to some constraints on the quantum secret 
|13j . Independently |17] introduced an ((n, n)) protocol for any n. This protocol 
is based on the GHZ state [7] which is locally equivalent to a complete graph 
state (Bj. The technique which consists in mixing the quantum secret before to 
encode it into a larger state is also used in p3] in such a way that some players 
have a classical share but no quantum share. 

We introduce a new family of secret sharing protocols using graph states. 
Like in [13] the quantum secret is encoded into a graph state shared between 
the players, but in order to obtain threshold protocols, an additional round 
is added to the protocol. This round consists in mixing the quantum secret 
using a one-time pad scheme which classical key is then shared between the 
players using a classical secret sharing protocol. This technique extends the one 
presented in [T7] in which the secret is partially mixed and then shared using a 
fixed quantum state, namely the GHZ state which is equivalent to the complete 
graph state. Independently, a hybrid classical-quantum construction of QSS has 
been rencently proposed in |5j where they optimize the quantum communication 
complexity when the size of the secret is greater than the number of players. 

The family of protocols we introduce in the present paper is parametrised 
by a pair (G, A) where G is a graph and A is a non empty set of vertices of the 
graph. We explore the possible values of k for which there exists a pair (G, A) 
leading to a ((k,n)) protocol. Our main results are: first, we introduce a family 
of graphs which can realise any ((k,n)) protocol when k > n — n 0,68 . This result 
proves that graph states secret sharing can be used not only for ((n, n)) proto- 
cols, but also for any threshold larger than n — n ' 68 . The second main result of 
the paper is the proof that there is no graph G such that (G, V{G)) realizes a 
((k,n)) protocols when k < j^n. Notice that this lower bound also applies in 



the protocol introduced by Markham and Sanders. Moreover, it suggests that 
secret sharing protocols with a threshold closed to half of the players cannot be 
achieve with shares of bounded size. 

Section [2] is dedicated to the description of the various secret sharing proto- 
cols based on graph states: section 12.11 describes the protocol cQSS introduced 
in [13] for sharing a classical secret, while section [2~T2l describes its extension to 
a quantum secret qQSS. We prove that the sufficient combinatorial conditions 
for accessibility and privacy introduced in [11] for these protocols are actually 
necessary. These graphical characterisation are key ingredients for proving the 
main results of this paper. In section 12.31 the new family of protocols qQSS* 
is introduced. In section [3] we prove that for any k > n — n ' 68 there exists a 
qQSS* protocol which realises a ((k,n)) secret sharing. Finally, in section^ we 
prove the following lower bound: for any k < y^g^ there is no graph G such 
that (G,V(G)) realises a ((k,n)) qQSS* scheme. A preliminary version of this 
work has been presented at [10J. 

2 Graph state secret sharing 

2.1 Sharing a classical secret using a graph state 

For a given graph G on n vertices v%, . . . ,v n , the corresponding graph state \G) 
is a n-qubit quantum state defined as 

l G > = 7fr £ (-l) fl0B) l*> 
* xe{o,i} n 

where q(x) is the number of edges in the induced subgraph G x = ({vi G 
V(G) | x t = 1}, G E(G) | x t = Xj = 1}). 

Graph states have the following fundamental fixpoint property: given a 
graph G, for any vertex u G V(G), 

x uZ N { u ) \G) = \G) 

where N(u) is the neighborhood of u in G, X = \x) i— >• \x), Z = \x) \— )■ (— l) x \x) 
are one-qubit Pauli operators and Za = (^uga Z u is a Pauli operator acting 
on the qubits in A. As a consequence, for any subset D C V(G) of vertices, 
®u&d-X-uZn(u) \G) = \G). Since X and Z anti-commutes and Z 2 = X 2 = I, 

(-l) lDn0ddm X D Z 0dd(D) \G) = (g) X U Z N(U) \G) = \G) 

where Odd(D) := {v G V(G) s.t. \N(v) n D\ = 1 mod 2} is the odd neighbor- 
hood of D. 



We present a family of quantum protocols for sharing a classical secret 
(cQSS) parametrized by a graph G and a non empty subset A of the vertices of 
the graph. This family of protocols has been introduced in fl3]. Obviously, shar- 
ing a classical bit can be done using a classical scheme, like [16] . instead of using 
a quantum state. However, the study of the cQSS protocols, and in particular 
the characterisation of accessibility and privacy (see corollary [1]) are essential 
for the next sections where the sharing of a quantum secret is considered. 

Suppose a dealer wants to share a classical secret s G {0, 1} between n = 
\V(G)\ players. The dealer prepares the state \G S ) = Z S A \G) where Z\ is the 
identity and Z\ consists in applying the Pauli operator Z on each qubit of 
A. The dealer sends each player i the qubit qi of \G S ). Regarding the recon- 
struction of the secret, a set B of players can recover the secret if and only if 
tr(/9B(0)/Os(l)) = 0, i.e. if the set of players can distinguish perfectly between 
the two states /Ob(0) and /0b(1), where pb(s) = tr v \ B (\G s ) (G s \) is the state of 
the subsystem of the players in B. On the other hand, a set B of players has no 
information about the secret if and only if p(0) and p(l) are indistinguishable, 
i.e. p(0) = p(l). 

Sufficient graphical conditions for accessibility and privacy have been proved 
in [TT] : 

Lemma 1 ([11]). Given a cQSS protocol (G,A), for any B C V(G), 

- If 3D C B s.t. D U Odd(D) C B and \D D A\ = 1 mod 2 then B can access 
the secret. 

- If3C QB = V{G) \B s.t. Odd{C) H B = An B then B has no information 
about the secret. 

According to the previous lemma, for a given set of players B C V(G), if 
3D C B s.t. D U Odd(D) C B and \D n A\ = 1 mod 2 then B can access the 
secret. More precisely, the players in B perform a measurement of their qubits 
according to the observable (— l)\ Dn0dd ( D ^XDZ 0dd ( D y This measurement pro- 
duces a classical outcomes s S {0, 1} which is the reconstructed secret [TT] . 

We prove that the sufficient graphical conditions are actually necessary con- 
ditions, and that any set of players is either able to access the secret or has no 
information about the secret. 

Lemma 2. Given a graph G and A C V(B), for any B C V(G), B satisfies 
exactly one of the two properties: 

i. 3D CB,Du Odd(D) C B A \D n A\ = 1 mod 2 

ii. 3C C V \ B, Odd(C) n B = A n S 

Proof. For a given £> C V(G), let -Tg^ be the cut matrix induced by B, 
i.e. the sub-matrix of the adjacency matrix r of G such that the columns 



of -Tg-g correspond to the vertices in B and its rows to the vertices in B. 
fgg is the matrix representation of the linear function which maps every 
X C B to r B g.X = Odd(X) n B, where the set X is identified with its 
characteristic column vector. Similarly, VI" C B, r B B .Y = Odd(Y) n B where 
Pg B = r^-g since r is symmetric. Moreover, notice that for any set X, Y C 

V(G), \X n y| mod 2 is given by the matrix product Y T .X where again sets 
are identified with their column vector representation. Equation (i) is satis- 
fied iff 3D s.t. (t^=-) D = (rj) which is equivalent to rank ( ( r^f ) = 
rank ( ^^j p ) = rank ( r B ° g j q ) = rank(r B|5 ) + l. Thus (i) is true iff H(B) = 
1 where i?(-B) := rank f ^0^1 ^ — rank(r BB -). Similarly equation (ii) is satisfied 

iff 3C s.t. r B B .C = AnB iff rank(r 5B |AnB) = rank(r BB ). Thus (ii) is true 
iff R(B) = 0. Since for any B C V(G),' € {0, 1} it comes that either (t) is 

true or (ii) is true. □ 

Corollary 1. Given a cQSS protocol (G,A), for any B C V(G), 

3D C D U Odd(D) CB A |D n A| = 1 mod 2 S can access the secret. 

3C QV\B, Odd{C) C\ B = AC\ B <?=^ B has no information about the secret. 



2.2 Sharing a quantum secret 



Following [13], the cQSS protocols are extended to qQSS schemes for sharing a 
quantum secret \(f>) = a |0) + f3 |1). Given a graph G and A a non empty subset 
of vertices, the dealer prepares the quantum state \G$) = a\Go) + f3\G\). 
Notice that the transformation |0) i— > \G<h) is a valid quantum evolution - 
i.e. an isometry - whenever |Gq) is orthogonal to |Gi) which is guaranteed by 
A ^ 0. Then, the dealer sends each player i the qubit qi of |G^). Regarding 
the reconstruction of the secret, it has been proved in [13], that a set B of 
players can recover the quantum state \(f>) if and only if B can reconstruct 
a classical secret in the two protocols cQSS(G, A) and cQSS(GAA, A), where 
GAA = (V(G),E(G)A(AxA)) <mdXAY = (XUY)\(XnY) is the symmetric 
difference. In other words GAA is obtained by complementing the egdes of G 
incident to two vertices in A. We introduce an alternative characterisation of 
q-accessibility (ability to reconstruct a quantum secret) which does not involved 
the complemented graph GAA: 

Lemma 3. Given a qQSS protocol (G,A), a set B of players can reconstruct 
the quantum secret if and only if, in the protocol cQSS (G, A), B can reconstruct 
the classical secret and B = V(G) \ B cannot. 



Proof. First notice that for any X, if \X fl A\ = 1 mod 2 then OddcAA(X) = 
Odd G {X)AA. Thus for any X,Y, if \X fl A\ = 1 mod 2, OA2 G z\aW D F = 

^ (Oddo(.X')AA) n y = (Odd G (x) n y)z\(A n y) = 
Odd G (x)ny = iny. 

(=£•) Assume that -B can reconstruct the quantum secret, so B can reconstruct 
the classical secret in GAA. Thus 3D C 5 s.t. OddcAA(D) nS = 0. According 
to the previous remark, it implies that Oddc(D) PiB = Ar)B, so B cannot 
reconstruct the secret. 

(<=) Assume B cannot recover the classical secret and B can. So 3C C B s.t. 
Odd G {C) H B = A n B. If \C H A\ is even, let C" := CZ\£> where |D n A\ 
is odd and Oddc(D) n B = 0. Such a set B> exists since B can reconstruct 
the classical secret in G. If \C n A| is odd, then let C := C . In both cases, 
\C H A\ = 1 mod 2 and Oddo(C) H B = An B, so according to the previous 
remark, OddGAA(C')r\B = 0, as a consequence B can access the classical secret 
in GAA. □ 

In any pure quantum secret sharing protocol a set of players can reconstruct 
a quantum secret if and only if its complement set of players has no information 
about the secret (see [§]). As a consequence: 

Corollary 2. Given a qQSS protocol (G,A), a set B of players has no infor- 
mation about the quantum secret if and only if, in the protocol cQSS (G,A), B 
can reconstruct the classical secret and B cannot. 

Sets of players that can reconstruct the secret and those who have no in- 
formation about the secret admit simple graphical characterisation thanks to 
the simple reduction to the classical case. However, contrary to the cQSS case, 
there is a third kind of set players, those who can have some information about 
the secret but not enough to reconstruct the secret perfectly. For instance for 
any n > 1 consider the qQSS protocol (K n , {v%, . . . , v n }) where K n is the com- 
plete graph on the n vertices Vx, . . . v n . For any set B of vertices s.t. -B 7^ and 
B 7^ 0, both B and B cannot reconstruct a classical secret in the corresponding 
cQSS protocol, so B cannot reconstruct the quantum secret perfectly but has 
some information about the secret. 

Corollary 3. The qQSS protocols (G, A) and (GAA, A) have the same ac- 
cessing structures - i.e. a set of players can access the secret in (G,A) iff it 
can access the secret in (GAA, A). In particular, the protocols (G,V(G)) and 
(G,V(G)) have the same accessing sets. 



2.3 Threshold schemes 



For any qQSS protocol (G, A), the accessing structures can be characterized. For 
secret sharing protocols, this is often interesting to focus on threshold protocols, 
i.e. protocols such that there exists an integer k such that any set of least k 
players can reconstruct the secret, whereas any set of at most k — 1 players 
have no information about the secret. Such threshold protocols are denoted 
((fc, n)). In [6], it has been proved that if the dealer is sending a pure quantum 
state to the players, like in the qQSS protocols, then the threshold, if it exists, 
should be equal to where n is the number of players. This property which 
is derived from the no-cloning theorem, is very restrictive. It turns out that 
there is a unique threshold for which a qQSS protocol is known. This protocol 
is (C5, {vx, . . . v$}) where C5 is the cycle graph on 5 vertices. The threshold 
for this protocol is 3. In section HI we prove that under the constraint that 
A = V[G), there is no threshold qQSS protocol for n > 79. 

However, in general a qQSS protocol corresponds to a ramp secret sharing 
scheme [15] where any set of players smaller than n — k cannot access the 
information and any set greater than k can. In this section we show how these 
ramp schemes can be turned into threshold schemes by adding a classical secret 
sharing round. 

Theorem 1. Given a graph G over n vertices, a non empty subset of vertices 
A, and an integer k, such that MB C V{G) with \B\ = k, 3Cb,Db Q B 
satisfying \D B D A\ = 1 mod 2, Odd(D B ) C B, and Odd(C B ) n B = A n B, it 
exists an ((k + c,n + c)) quantum secret sharing protocol for any c > in which 
the dealer sends one qubit to n players and uses a (k + c)-threshold classical 
secret sharing scheme on the n + c players. 

The rest of the section is dedicated to define a family of protocols called 
qQSS* satisfying the theorem. 

Inspired by the work of Broadbent, Chouha and Tapp [17], we extend the 
qQSS scheme adding a classical reconstruction part. In [T7J, a family of una- 
nimity - i.e. the threshold is the number of players - quantum secret sharing 
protocols have been introduced. They use a GHZ state which equivalent to 
the graph state \K n ) where K n is the complete graph on n vertices. We extend 
this construction to any graph, using also a more general initial encryption 
corresponding to a quantum one-time pad of the quantum secret. 

Quantum secret sharing with graph states and classical reconstruc- 
tion (qQSS*). Given a graph G, a non empty subset of players A, and an 
integer fc, such that MB C V(G) if \B\ > k then 3Cb,D b Q B satisfying 
\D B n A\ = 1 mod 2, Odd(D B ) C B, and Odd(C B ) n B = A n B. 
Suppose the dealer wishes to share the quantum secret \<j>) = a |0) + |1). 



— Encryption. The dealer chooses uniformly at random b x ,b z G {0, 1}. and 
apply X bx Z b " on |0}.The resulting state is \4>') = a \b x ) + f3(-l) bz \b~ x ). 

— Graph state embedding. The dealer embeds \4>') to the n-qubit state 
a\G bx ) + /3(-l) b *\G^). 

— Distribution. The dealer sends each player i the qubit qi. Moreover using 
a classical secret sharing scheme with a threshold k, the dealer shares the 
bits b x ,b z . 

— Reconstruction. The reconstruction of the secret for a set B of players 
s.t. \B\ > k is in 3 steps: first the set Db is used to add an ancillary 
qubit and put the overall system in an appropriate state; then Cb is used 
to disentangled the ancillary qubit form the rest of the system; finally the 
classical bits b x and b z are used to recover the secret: 

- (a) The players in B applies on their qubits the isometry Ud b '■= |0) ® 
Po + 1 1) ® Pi where Pi are the projectors associated with observable Od b = 
(-l)\D B nOdd{D B )\ XDBZodd{D ^ ie p . . = i+(-iYO DB regulting gtate 

is a \b x ) ® \G bx ) + /3.(-l) 6 * \b x ) ® \G b -). 

- (b) The players in B apply the controlled unitary map ^v Cb = |0) (0| ® 
I + |1) (1| ® V Cb , where V c := {-^ Cf]0dd{C) ^ X c Z 0dd{ c)AA- The resulting 
state is a \b x ) ® |G) + /3.(-l) 6z |6x> ® |G) = (a + /3.(-l) 6z |^» ®\G), 

- (c) Thanks to the classical secret sharing scheme, the players in B recover 
the bits b x and b z . They apply X bx and then Z bz for reconstructing the 
quantum secret a |0) + /3 |1) on the ancillary qubit. 

Note that this reconstruction method can be used for the qQSS protocols 
defined in [11] and for which the reconstruction part was not explicitly defined. 

Lemma 4. A qQSS* protocol (G,A,k) is a ((k,\V(G)\)) secret sharing pro- 
tocol if for any B C V{G) s.t. \B\ > k, B can reconstruct the secret in 
qQSS{G,A). 

Proof. The classical encoding ensures that any set of size smaller then k cannot 
access to the secret. Od b is acting on the qubits DbCiOoI^Db) Q B. Moreover 
Pi \G S ) = \G S ) if i = s and otherwise, so the application of the isometry Ud b 
produce the state a\b x ) ® \G bx ) +/?.(— l) bz \b x ) (g> IGy). Regarding step b of the 
reconstruction, since Odd(C)nB = AnB, CL>Odd(C)AA C B Vc is acting on 
the qubits in B. Moreover Vc produces the states (a \ b x ) + /3.(— l) bz \b x )) \G). 
Finally the classical secret scheme guarantees that the players in B have access 
to b x and b z so that they reconstruct the secret. □ 

Proof of Theorem [TJ The correctness of the qQSS* protocol implies that 
given a graph G over n vertices, a non empty subset of vertices A, and an 



integer k, such that \/B C V(G) with \B\ = k, 3C B ,D B C B satisfying \D B n 
A| = 1 mod 2, Odd(D B ) C 5, and Odd{C B ) n U = yl n 5, it exists a ((fc,n) 
protocol. In order to finish the proof of Theorem [T] this protocol is turned into a 
((& + c, n + c)) protocol for any c > the qQSS* protocol is modified as follows, 
following the technique used in [14]. During the distribution stage, the dealer 
shares b x and b z with all the n + c players with a threshold k + c, but sends a 
qubit of the graph state to only n players chosen at random among the n + c 
players. During the reconstruction, a set of k + c players must contain at least k 
players having a qubit. This set use the reconstruction steps a and b and then 
the last step c is done by all the k + c players. □ 

In the following we focus on the particular case where A = V(G). 
3 Building ((n - n°- 68 ,n))-qQSS* Protocols 

We give a construction of an infinite family of quantum secret sharing schemes 
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((k,n)) where k = n — n' ^ 5 ' < n — n . This construction can be defined 
recursively from cycle over 5 vertices (C5) which has been used in Markham 
and Sanders [13] to build a ((3,5)) quantum secret sharing protocol. 

We define a composition law * between two graphs G\ = (Vi,Ei) and 
G2 = (^,£2) as follows: 

Definition 1. Let G\ = (Vi,Ei) and G2 = (V^-Eb) be two graphs. The lexico- 
graphic product * of two graphs G\ and G2 is defined as follows: V(G\ * G2) '■= 
Vi x V 2 and E(Gi * G 2 ) := {((«i, u 2 ), (vi, V2)) \ (ui,vi) G E\ or (u\ = V\ A 
(U2,v 2 ) G E 2 )}. 

In other terms, the graph G is a graph G% which vertices are replaced by 
copies of the graph G2 , and which edges are replaced by complete bipartitions 
between two copies of the graph G2 (Figured]). 

Lemma 5. For any graphs G\ and G2, G\ * G2 = G\ * G2 

Proof. It is easy to see that V(G\ * G 2 ) = V{G\ * G 2 )- We want to show that 
E{Gi * G 2 ) = E{G[*G~2). 

Consider an edge ((wi, ^2), (v\, v 2 )) G E(G\ * G 2 )- If u\ = v\ then (u 2 , v 2 ) ^ 
E 2 - Otherwise (u\,vi) ^ E\. Thus («i,ui) G E\ or (u\ = v\ and (1*2, 1*2) G E2) 
which means, by definition, that Uui,u 2 ),(vi,V2)) G E{G\ * G 2 ). Therefore, 
E(G 1 *G 2 ) C E{Gl*G~2). 

Furthemore \E{fll* G^)| = m\E(Ch)\ + n 2 2 \E{G[)\ where m = \V t \ and 
n 2 = \V 2 \. T hus \E(Gi * G ^)\ = n 1 n 2 {n 1 n 2 - l)/2 - (n x E{G 2 ) + r%E(G{)) = 
\E(Gi * G 2 )\. Therefore E(Gi * G 2 ) = E(Gi * G 2 ). □ 



A 




Fig. 1. Graphical explanation of the composition law * between two graphs. A thick line 
represents a complete bipartition between two triangle graphs. 



Lemma 6. Let G±, G 2 be two graphs such that G\ = (Vi,Ei) realizes an 
((fci,ni)) qQSS* protocol andG2 = {V 2 ,E 2 ) realizes a ((k 2 ,n 2 )) qQ S S* protocol. 
The graph G = G\ * G2 = (V,E) realizes an((k,n)) qQSS* protocol where 



( n = nin 2 

\ k = n\n<i — (ni — k\ + l)(n 2 — + 1) + 1 



Proof. First we show that if G\ = (V\_,Ei) realizes an {(ki, ni)) qQSS* protocol 
and G2 = (V 2 ,E 2 ) realizes an ((k 2 ,n 2 )) qQSS*, then, in the graph G = G\ * 
G2 = (V, E), for any set B C V of size k (with A; = nin 2 — (ni — fci + l)(n 2 — 
fc 2 + 1) + 1 it exists a set -De such that \Db\ = 1 mod 2, Odd(DB) Q B. 

For any set i? C V and any vertex -ui G V, let i? 2 (t>i) = {-u 2 G V2 s.i. (vi, 1*2) € 
B} and Bi = { Vl £ Vi s.t. |B 2 («i)l > k 2 }. 

We claim that for all set B C V of size |J3| = k, the size of the set B\ verifies 

\Bi\ > h. 

By contradiction, notice that B = \J V2e B 2 ( Vl ) v 1 eV 1 {( v i> v z)}- Therefore: 
\B\ = \V\ - E„ l6Bl \V 2 \ B 2 ( Vl )\ - E„ ie y ABl \V2 \ B 2 ( Vl )\. Thus \B\ < n x n 2 - 
\V\ \ Bi\(n 2 - k 2 + 1) < k - 1 if |#i| < fci. 

Now we consider any set i? C V of size |2?| = k. As |Bi| > k\, it exists a 
set Di C 5i with |L>i| = 1 mod 2 and £>i U Odd(L>i) C Bj. 

Furthermore for any t>i G |-E>2(^i)| > &2 and thus there exists I?2(^i) ^ 
5 2 (ui)) with \D 2 (vi)\ = 1 mod 2 and D 2 (v 1 )uOdd{D 2 (v 1 )) C JB 2 (ui) and there 
exist C 2 (i>i) C B 2 («i) with V 2 \ B 2 («i) C Odd(C 2 (vi))). 

Let C§(«i) = C 2 (ui) if |C 2 (ui)| = 0mod2 and C§(ui)^D 2 (t;i) otherwise, 
and let C\ \v x ) = C% ( Vl ) AD 2 («i ) . 



We partition V% in 4 subsets and define for any vertex v\ a set S 2 (i>i) C V 2 
as follows 

{livi e D 1 nEven(D 1 ) , S 2 (vx) = D 2 {v x ) 
If «i € A n Oddpi ) , 5 2 (vi) = G 2 X ( Wl ) ) 
If v 1 eV 1 \D 1 n Even(D x ) , S 2 (vx) = 
If v 1 €V 1 \D 1 n OddiDr) , S 2 ( Vl ) = C§(ui) 

Consider the set Db = U^eViW} x ^2(^1)) Db Q B and \Db\ = 

|c§(«i)|. 

Therefore \D B \ = \D X \ = 1 mod 2. 

For each v = (vi,v 2 ) EV\B, \M g (v) n D B | = |A/g 2 (>2) n S 2 (>i)| 
+ Eu 1 eAf Gl (vx)\ S ^)l If y i e then \S 2 (vi)\ = mod 2, thus 

|AT G (w) n D B | = |AA G2 (i. 2 ) n 5 2 (ui)| + |AT Gl («i) n £>i| mod 2. 

Furthermore, if «i G Even(Dx), \Ng 2 {v 2 ) D 5 2 («i)| = |JVgi(«i) H -Di| = 
mod 2 and if «i G Odd{Di), \M G2 {v 2 ) n 5 2 (ui)| = lA^M n £>i| = 1 mod 2. 

Therefore |A/g(u) n D B \ = mod 2 which implies that D B UOdd(D B ) C B. 

Furthermore, using Lemma [5j we have G\ * G 2 = G x * G 2 . And from corol- 
lary [3l as Gi and G 2 realize qQSS* protocols G\ and G 2 have the same 
threshold .Therefore, in G\ * G 2 it exists a set D' B such that its odd neigh- 
borhood in the complementary graph satisfies Odd GijfGj2 {D' B ) (~)V \ B = $ thus 
Odd Gl * G2 (D' B ) n V \ B = V \ B and D' B is a valid G B to define an ((fc,n)) 
gQSS* protocol. □ 

Let us define G** = G * G * • • • * G . If G realizes a ((&, n)) protocol, we want 

i times 

to find m and k{ such that G* 1 realizes a ((fcj,nj)) protocol: 

Lemma 7. Lei G be a graph which realizes a ((k,n)) protocol. Then the graph 
G* % realizes a ((ki,rii)) protocol where 

( m = n l 

\k i = n i -(n-k + l) i + l 

Proof. By induction: first, we notice that n\=n and &i = fc. Then, if we write 
G* l+1 = G* G*', from Lemma|6]nj + i = n.rii and fcj-fi = n.rii — (n — k + l)(rij — 
fci + 1) + 1 

One can see that = n\ Now we consider the sequence Uj = Tij — ki + 1. 
ui = n — k + 1 and itj+i = (n — A; + l)uj.We deduce that m = (n — k + 1)*. 
Thus, by definition of (uj), fej = n« — U{ + 1 = n l — (n — k + 1) % + 1. □ 
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Fig. 2. Decomposition of the graph Ct,* %+1 . 

Theorem 2. For all i £ W, the graph C^* % realizes a ((n,n — n l ° 3 ^ + 1)) 
protocol (with n = h l ). 

Proof. In Lemma [7] with n = 5 and k = 3 (since the graph C5 realizes a ((3, 5)) 

[13]), we have n = rij = 5* and k{ = 5* — 3* + 1 = 5 l — 5 io s( 5 ) +1 = n — n lo <>( 5 ) +1. 
□ 

4 Lower Bound 

By the no-cloning theorem, it is not possible to get two separated copies of 
the secret starting from only one copy. Thus, if we consider a quantum secret 
sharing protocol with parameters ((k,n)) we must have k > ^. 

We derive here less trivial lower bounds for our family of protocols. 
Definition 2. Let B be a subset of vertices of a graph. 

- D C B is said to be "odd-wise in B" or "B-odd-wise" iff DU Odd(D) C B 

— C C B is said to be "even-wise in B" or "B -even-wise" iff CL)Even(C) C B 

Lemma 8. Let G = (V,E) be a graph which realizes a ((k,n)) protocol. Then, 
for all set B of size k, there exists a set X C B such that: \X\ < | (n — k + 1) 
where X is either a B-odd-wise set of size 1 mod 2 or a B-even-wise set. 

Proof. First, let Is G Aik,n-k(^2) be a cut matrix of G corresponding to 
the cut (B, V \ B). We can see Is as the linear map that maps a set D C 
B to its odd neighbourhood in V \ B: Consequently, any .B-odd-wise set D 
corresponds to a linear combination of the columns of the matrix which 
equals the null vector. Therefore, is odd-wise in B} = i^er(Js), and 

t = dim{Ker{FB) = k — dim{Lm{rB)) >2k — n. 



As \XAY\ = \X\ + |F|mod2, the sets V x = {D C B,\D\ = 1 mod 
2 D odd-wise in B} and C x = {C C B,C even-wise in B} are two affine sub- 
spaces having the same vector subspace T>q = {D C B, \D\ = mod 2 A 
D odd-wise in B}. 

The dimension of Po is t — 1, therefore, by gaussian elimination its exists a 
set Xq C £?, |Xo| = i — 1 such that it exists sets C x E Ci and D x E Pi satisfying 
X n Ci = X n L»i = 0. Thus Id U D x \ < k - 1 + 1 < n- k + 1. 

Therefore 2\D X U C x \ = \D X \ + \C X \ + \D X AC X \ <2(n-k + l) which implies 
that one of the three sets has cardinality smaller than 2(n — k + 1), as the first 
set is odd- wise with odd cardinality and the two others are even- wise in B, 
which concludes the proof. □ 

By counting the even-wise and odd-wise sets and their possible completion 
into q-accessing sets, we get the following lower bound. 

Theorem 3. There exists no graph G that has an ((k,n)) qQSS protocol with 

* ^ 2 ' 157" 

Proof. We consider a graph G = (V,E) which realizes a ((k,n)) secret sharing 
protocol. 

Any set of size n — k is not c-accessing, therefore, any set D, with \D\ = 
1 mod 2 satisfies \D U Odd(D)\ > n — k + 1. Consequently, given a set D, 
with \D\ = 1 mod 2, it exists at most (^~i n ~^ + ]}) = (r l , k ~ 1 ,) sets B of size k 

1 1 ' Vfc— (n— fc+1)/ V2fe— n— 17 

containing D U Odd(D) and such that D is odd-wise in i3. 

Similarly, any set of size k is c-accessing, for any set C, \C U i£uen(C)| > 
n—k + 1. Therefore, given a set C the number of sets B of size containing C 
and such that C is even-wise in .B is at most (2^—^—1) ■ 

With Lemma [8l each set B C V of size contains either a i?-odd-wise 
subset D of size odd or a S-even-wise subset C such that \D\ < |(n — + or 
|C| < I (n— fc+1). Thus by counting twice all the sets of cardinality smaller then 
|(n — fc + 1) (as a potential odd- wise or even- wise set) we can upper bound the 

set of possible cuts of size fc with (^) < 2 Y2f=i (?) (2fc-~n-i) ■ ^ ne previous 
inequality implies that fc > ^ + ^ when n — > 00. □ 

Corollary 4. There exists no qQSS protocol for n > 79 

Proof By Gottesman's characterisation |6j a qQSS protocol has a threshold 
((fc,2fc — 1)). Moreover, fc > n/2 + n/157 using the previous lower bound. 
Therefore fc < 159/4 and the number of players n = 2k — 1 > 79. □ 
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